File Downloads

When urlscan.io scans a website which triggers a file download, it will attempt to wait for the file to be downloaded and then store the downloaded file so it can later be retrieved from urlscan.io. Scans which triggered file downloads can be found via the Search API and the different files.* query terms. To explore downloaded files you can check out the dedicated Files search.

Files are only available in urlscan Pro.

Limitations

• We will not attempt to download or store files that are bigger than 50MB (52428800 bytes).
• We will not process downloaded files in any way except basic operations such as SHA256 and MIME Type detection.
• We will not share files with any third-party providers (e.g., uploading those files to Virustotal).
• We will not annotate files with any third-party information.
• We will not scan files in any way or try to determine if a file is malicious.
• For failed downloads we will show you the filename, file size and the URL that the file would have been downloaded from.

To get a feed of files that were downloaded by urlscan.io, you can use the regular Search API to only retrieve scans with successful file downloads:

curl https://urlscan.io/api/v1/search?q=files.sha256:*

The scans will contain a files array with one or multiple files and different attributes, such as sha256. Use the sha256 of the file to download the actual file from urlscan.io.